Newer
Older
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
# mediadrmserver - mediadrm daemon
type mediadrmserver, domain;
type mediadrmserver_exec, exec_type, file_type;
typeattribute mediadrmserver mlstrustedsubject;
net_domain(mediadrmserver)
init_daemon_domain(mediadrmserver)
binder_use(mediadrmserver)
binder_call(mediadrmserver, binderservicedomain)
binder_call(mediadrmserver, appdomain)
binder_service(mediadrmserver)
# Required by Widevine DRM (b/22990512)
allow mediadrmserver self:process execmem;
# System file accesses.
allow mediadrmserver system_file:dir r_dir_perms;
allow mediadrmserver system_file:file r_file_perms;
allow mediadrmserver system_file:lnk_file r_file_perms;
# Read files already opened under /data.
allow mediadrmserver system_data_file:dir { search getattr };
allow mediadrmserver system_data_file:file { getattr read };
allow mediadrmserver system_data_file:lnk_file r_file_perms;
# Read access to pseudo filesystems.
r_dir_file(mediadrmserver, cgroup)
allow mediadrmserver cgroup:dir { search write };
allow mediadrmserver cgroup:file w_file_perms;
# Allow access to ion memory allocation device
allow mediadrmserver ion_device:chr_file rw_file_perms;
# Allow access to app_data and media_data_files
allow mediadrmserver media_data_file:dir create_dir_perms;
allow mediadrmserver media_data_file:file create_file_perms;
allow mediadrmserver media_data_file:file { getattr read };
allow mediadrmserver tee_device:chr_file rw_file_perms;
# XXX Label with a specific type?
allow mediadrmserver sysfs:file r_file_perms;
# Connect to tee service.
allow mediadrmserver tee:unix_stream_socket connectto;
allow mediadrmserver mediadrmserver_service:service_manager { add find };
allow mediadrmserver mediaserver_service:service_manager { add find };
allow mediadrmserver processinfo_service:service_manager find;
allow mediadrmserver surfaceflinger_service:service_manager find;
allowxperm mediadrmserver self:{ rawip_socket tcp_socket udp_socket }
ioctl { unpriv_sock_ioctls unpriv_tty_ioctls };
###
### neverallow rules
###
# mediadrmserver should never execute any executable without a
# domain transition
neverallow mediadrmserver { file_type fs_type }:file execute_no_trans;
# do not allow privileged socket ioctl commands
neverallowxperm mediadrmserver domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;